Description
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.10.22, 3.11.0 – < 3.11.17, 3.12.0 – < 3.12.15, 3.13.0 – < 3.13.16, 3.14.0 – < 3.14.8, 3.15.0a1 – < 3.15.0rc2 | 3.10.22 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pypy3 | 8.0.1+dfsg-1 | — |
| Debian 14 | python3.14 | 3.14.7-3 | — |
| Debian 14 | python3.15 | 3.15.0~rc2-1 | — |
| Debian 13 | pypy3 +1 | No fix yet | — |
| Debian 12 | pypy3 | No fix yet | — |
| Debian 12 | python3.11 | 3.11.2-6+deb12u9 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python3.14 | No fix yet | — |
| Ubuntu 26.04 LTS | python3.14 | No fix yet | — |
| Ubuntu 24.04 LTS | python3.12 | No fix yet | — |
| Ubuntu 22.04 LTS | python3.10 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python2.7 +2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python2.7 +3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python2.7 +2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python3 +15 | 3.14.7-1.1.hum1 | RHSA-2026:65505 |
| Red Hat Hardened Images 1 | python3.10 +6 | 3.10.21-1.1.hum1 | RHSA-2026:74868, RHSA-2026:65513 |
| Red Hat Hardened Images 1 | python3.11 +6 | 3.11.16-1.2.hum1 | RHSA-2026:65525 |
| Red Hat Hardened Images 1 | python3.12 +6 | 3.12.14-1.1.hum1 | RHSA-2026:65531 |
| Red Hat Hardened Images 1 | python3.13 +8 | 3.13.15-1.1.hum1 | RHSA-2026:65567 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | python +1 | 2.7.18-150000.133.1 | SUSE-SU-2026:4411-1 |
| SLES 15 SP7 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES 15 SP7 | python311-core | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 |
| SLES 15 SP6 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES 15 SP6 | python311 +1 | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 |
| SLES 15 SP6 | python312 +1 | 3.12.14-150600.3.68.1 | SUSE-SU-2026:4534-1 |
| SLES 15 SP5 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES 15 SP5 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
| SLES 15 SP4 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES 15 SP4 | python310 +1 | 3.10.22-150400.4.129.1 | SUSE-SU-2026:4630-1 |
| SLES 15 SP4 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
| SLES 12 SP5 | python +2 | 2.7.18-33.88.1 | SUSE-SU-2026:4633-1 |
| SLES 12 SP5 | python3 +1 | 3.4.10-25.199.1 | SUSE-SU-2026:4744-1 |
| SLES 12 SP5 | python36 +1 | 3.6.15-125.1 | SUSE-SU-2026:4743-1 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 3 | python311 +1 | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 |
| SLES 3 | python313 +1 | 3.13.15-150700.4.56.1 | SUSE-SU-2026:4941-1, SUSE-SU-2026:4401-1 |
| SLES for SAP 15 SP6 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES for SAP 15 SP6 | python311 +1 | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 |
| SLES for SAP 15 SP6 | python312 +1 | 3.12.14-150600.3.68.1 | SUSE-SU-2026:4534-1 |
| SLES for SAP 15 SP5 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES for SAP 15 SP5 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
| SLES for SAP 15 SP4 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES for SAP 15 SP4 | python310 +1 | 3.10.22-150400.4.129.1 | SUSE-SU-2026:4630-1 |
| SLES for SAP 15 SP4 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
| SLE Micro 6.1 | python311 +1 | 3.11.16-slfo.1.1_1.1 | SUSE-SU-2026:24280-1, SUSE-SU-2026:23743-1 |
| SLE Micro 6.0 | python311 +1 | 3.11.16-1.1 | SUSE-SU-2026:24325-1, SUSE-SU-2026:23845-1 |
| SLE Micro 5.5 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLE Micro 5.4 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLE Micro 5.3 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLE HPC 15 SP5 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLE HPC 15 SP5 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
| SLE HPC 15 SP4 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLE HPC 15 SP4 | python310 +1 | 3.10.22-150400.4.129.1 | SUSE-SU-2026:4630-1 |
| SLE HPC 15 SP4 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python310 | 3.10.21-2.1 | openSUSE-SU-2026:11949-1 |
| openSUSE Tumbleweed | python311 | 3.11.16-2.1 | openSUSE-SU-2026:11886-1 |
| openSUSE Tumbleweed | python312 | 3.12.14-2.1 | openSUSE-SU-2026:11975-1 |
| openSUSE Tumbleweed | python313 | 3.13.15-1.1 | openSUSE-SU-2026:11817-1 |
| openSUSE Tumbleweed | python314 | 3.14.7-2.1 | openSUSE-SU-2026:11868-1 |
| openSUSE Tumbleweed | python315 | 3.15.0~rc2-1.1 | openSUSE-SU-2026:11748-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | python3 | 3.14.8-r0 | — |
| Alpine v3.23 | python3 | 3.12.15-r0 | — |
| Alpine v3.22 | python3 | 3.12.15-r0 | — |
| Alpine v3.21 | python3 | 3.12.15-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3.11 +6 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 |
| Amazon Linux 2023 | python3.12 +6 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 |
| Amazon Linux 2023 | python3.13 +8 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 |
| Amazon Linux 2023 | python3.14 +13 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python3 | 3.12.15-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | python-3.10 | 3.10.21-r4 | — |
| Wolfi rolling | python-3.11 | 3.11.16-r5 | — |
| Wolfi rolling | python-3.12 | 3.12.14-r6 | — |
| Wolfi rolling | python-3.13 | 3.13.15-r6 | — |
| Wolfi rolling | python-3.14 | 3.14.7-r6 | — |
Advisories 34
- SSA-457936 SSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7 Siemens ProductCERT · Nov 10, 2026
- SUSE-SU-2026:4946-1 Security update for python311 SUSE / openSUSE Security Updates · Oct 31, 2026
- SUSE-SU-2026:4941-1 Security update for python313 SUSE / openSUSE Security Updates · Oct 31, 2026
- WID-SEC-2026-2924 CPython: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 29, 2026
- SUSE-SU-2026:24325-1 Security update for python311 SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:24280-1 Security update for python311 SUSE / openSUSE Security Updates · Oct 27, 2026
- ALAS2023-2026-3230 Important: python3.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3231 Important: python3.11 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3232 Important: python3.14 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3229 Important: python3.13 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- SUSE-SU-2026:4809-1 Security update for python311 SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:4754-1 Security update for python3 SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:4743-1 Security update for python36 SUSE / openSUSE Security Updates · Oct 20, 2026
- SUSE-SU-2026:4744-1 Security update for python3, python3-base, python3-doc SUSE / openSUSE Security Updates · Oct 20, 2026
- RHSA-2026:65525 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:65505 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:65531 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:65567 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:65513 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:74868 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- SUSE-SU-2026:4633-1 Security update for python SUSE / openSUSE Security Updates · Oct 13, 2026
- SUSE-SU-2026:4630-1 Security update for python310 SUSE / openSUSE Security Updates · Oct 13, 2026
- SUSE-SU-2026:4534-1 Security update for python312 SUSE / openSUSE Security Updates · Oct 6, 2026
- openSUSE-SU-2026:11975-1 python312-3.12.14-2.1 on GA media SUSE / openSUSE Security Updates · Oct 3, 2026
- openSUSE-SU-2026:11949-1 python310-3.10.21-2.1 on GA media SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:4411-1 Security update for python SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:4401-1 Security update for python313 SUSE / openSUSE Security Updates · Oct 1, 2026
- SUSE-SU-2026:4396-1 Security update for python311 SUSE / openSUSE Security Updates · Sep 30, 2026
- SUSE-SU-2026:23845-1 Security update for python311 SUSE / openSUSE Security Updates · Sep 27, 2026
- SUSE-SU-2026:23743-1 Security update for python311 SUSE / openSUSE Security Updates · Sep 27, 2026
- openSUSE-SU-2026:11886-1 python311-3.11.16-2.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026
- openSUSE-SU-2026:11868-1 python314-3.14.7-2.1 on GA media SUSE / openSUSE Security Updates · Sep 24, 2026
- openSUSE-SU-2026:11817-1 python313-3.13.15-1.1 on GA media SUSE / openSUSE Security Updates · Sep 19, 2026
- openSUSE-SU-2026:11748-1 python315-3.15.0~rc2-1.1 on GA media SUSE / openSUSE Security Updates · Sep 11, 2026
References
- https://github.com/python/cpython/pull/155293 patch
- https://github.com/python/cpython/issues/155292 issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/ vendor-advisory
- https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc patch
- https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7 patch
- https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae patch
- https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214 patch
- https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296 patch
- https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784 patch
- https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296 patch
- https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72 patch